Transformational Security Awareness Transformational Security Awareness What Neuroscientists, Storytellers, and Marketers Can Teach Us About Driving Secure Behaviors Perry Carpenter Transformational Security Awareness: What Neuroscientists, Storytellers, and Marketers Can Teach Us About Driving Secure Behaviors Published by John Wiley & Sons, Inc. 10475 Crosspoint Boulevard Indianapolis, IN 46256 www.wiley.com Copyright © 2019 by John Wiley & Sons, Inc., Indianapolis, Indiana Published simultaneously in Canada ISBN: 978-1-119-56634-2 ISBN: 978-1-119-56637-3 (ebk.) ISBN: 978-1-119-56635-9 (ebk.) Manufactured in the United States of America 10 9 8 7 6 5 4 3 2 1 No part of this publication may be reproduced, stored in a retrieval system or transmitted in any form or by any means, electronic, mechanical, photocopying, recording, scanning or otherwise, except as permitted under Sections 107 or 108 of the 1976 United States Copyright Act, without either the prior written permission of the Publisher, or authorization through payment of the appropriate per-copy fee to the Copyright Clearance Center, 222 Rosewood Drive, Danvers, MA 01923, (978) 750-8400, fax (978) 646-8600. Requests to the Publisher for permission should be addressed to the Permissions Department, John Wiley & Sons, Inc., 111 River Street, Hoboken, NJ 07030, (201) 748-6011, fax (201) 748-6008, or online at http://www.wiley.com/go/ permissions. Limit of Liability/Disclaimer of Warranty: The publisher and the author make no representations or warranties with respect to the accuracy or completeness of the contents of this work and specifically disclaim all warranties, including without limitation warranties of fitness for a particular purpose. No warranty may be created or extended by sales or promotional materials. The advice and strategies contained herein may not be suitable for every situation. This work is sold with the understanding that the publisher is not engaged in rendering legal, accounting, or other professional services. If professional assistance is required, the services of a competent professional person should be sought. Neither the publisher nor the author shall be liable for damages arising herefrom. The fact that an organization or Web site is referred to in this work as a citation and/or a potential source of further information does not mean that the author or the publisher endorses the information the organization or website may provide or recommendations it may make. Further, readers should be aware that Internet websites listed in this work may have changed or disappeared between when this work was written and when it is read. For general information on our other products and services please contact our Customer Care Department within the United States at (877) 762-2974, outside the United States at (317) 572- 3993 or fax (317) 572-4002. Wiley publishes in a variety of print and electronic formats and by print-on-demand. Some material included with standard print versions of this book may not be included in e-books or in print-on-demand. If this book refers to media such as a CD or DVD that is not included in the version you purchased, you may download this material at http://booksupport.wiley .com. For more information about Wiley products, visit www.wiley.com. Library of Congress Control Number: 2019933733 Trademarks: Wiley and the Wiley logo are trademarks or registered trademarks of John Wiley & Sons, Inc. and/or its affiliates, in the United States and other countries, and may not be used without written permission. All other trademarks are the property of their respective owners. John Wiley & Sons, Inc. is not associated with any product or vendor mentioned in this book. For Siobhan, Sage, and Lily: the best reasons imaginable to help build a more secure planet. Oh - and thanks for putting-up with all the puns . . . About the Author Perry Carpenter, C|CISO, MSIA currently serves as Chief Evangelist and Strategy Officer for KnowBe4, the world’s most popular security awareness and simulated phishing platform. Perry has been a recognized thought leader on security awareness and the human factors of security for well-over a decade. His broad background makes him uniquely positioned to understand nuances of awareness strategy that can be elusive. Perry’s security awareness-related experiences spans multiple pivotal roles: from being a general employee receiving awareness training; to being an awareness program manager running complex global programs; to being the primary market analyst advising security leaders about awareness trends, success practices, and vendor platforms; to now helping lead the efforts of the world’s largest and most successful security awareness and simulated phishing platform. Perry draws from this expe- rience, along with cutting-edge research in the fields of marketing, com- munication, behavior science, and organizational culture management to inform his perspectives and advice for creating awareness programs that are transformational. Before joining KnowBe4, Perry led security awareness, security culture management, and anti-phishing behavior management research at Gartner Research (NYSE:IT), in addition to covering areas of IAM strategy, CISO Program Management mentoring, and Technology Service Provider suc- cess strategies. With a long career as a security professional and researcher, Carpenter has broad experience in North America and Europe, providing security consulting and advisory services for many of the world’s best-known brands. Perry holds a Master of Science in Information Assurance (MSIA) from Norwich University in Vermont and is a Certified Chief Information Security Officer (C|CISO). You can connect with Perry on LinkedIn at: https://linkedin.com/in/ perrycarpenter. About the Technical Editor Matt Stamper, CISA, CISM, CIPP/US, ITIL, brings a broad, multi-disciplinary understanding of cybersecurity best practices. His diverse domain knowledge spans IT service management (ITSM), cybersecurity, cloud services, control design and assessment (Sarbanes-Oxley, HIPAA-HITECH), privacy (GDPR, CCPA), enterprise risk management (ERM), and IT risk management (ITRM). Matt excels at conveying complex cybersecurity and IT concepts to boards of directors, executive management, as well as professional service providers. His executive and board-level experience with managed services, cybersecu- rity, data centers, networks services, and ITSM provide a unique perspective on the fast-changing world of enterprise IT, IoT, and cloud services. Stamper was a Research Director within the Security and Risk Management Practice at Gartner (NYSE:IT). During his time at Gartner, Stamper met with CISOs and CIOs across the globe to address cybersecurity program development, security incident response, and other security topics. Matt was the co-author on the Magic Quadrant for IT Risk Management Solutions and wrote research on incident response and covered breach and attack simulation technologies. Matt is also the co-author of the CISO Desk Reference Guide (Volumes 1 & 2). You can connect with Matt on LinkedIn at: https://www.linkedin.com/ in/stamper/ Credits Associate Publisher Copy Editor Jim Minatel Kim Wimpsett Editorial Manager Proofreader Pete Gaughan Evelyn Wellborn Production Manager Indexer Kathleen Wisor Johnna VanHoose Dinse Project Editor Cover Designer Tom Dinse Wiley Production Editor Cover Image Athiyappan Lalith Kumar © wildpixel/iStockphoto Technical Editor Matt Stamper Acknowledgments Wow! Writing a book is such a big process; draining at times, and life-giving at others. During the writing of this book I had times of intense focus and productivity when it felt like words and information were gleefully flying from my fingertips to my keyboard and onto my screen, sitting there virtually smil- ing back at me. And there were other times when, frankly, I felt like finding a box of toothpicks and stabbing the entire contents of the box, toothpick by toothpick, into my eyes just to make it end. Ok . . . that’s a bit of an exaggeration. But you wanna’ know what’s not an exaggeration? Sure you do. So, I say this in all seriousness: Though my name adorns the wonderfully designed cover of this book, it is only able to do so because of a list of countless other names. The names of people who have provided me with so much help and encouragement throughout my life and career. I’ll start with the most important group in my life: my family. To my amaz- ing wife, Siobhan: Thank you for always believing in me; for dealing with my craziness; and for helping me become a better version of myself, every day. You have the biggest heart of anyone I know. I’m so lucky to call you my bride and my friend. To my kids, Sage and Lily: I love you more than words can express. You make me prouder than you’ll ever know. Thanks to my mom and dad for always encouraging me to be multidis- ciplinary in my thinking and skills development. That multidisciplinary thinking is at the core of this book. There are so many great people who’ve helped me throughout my career; many of whom I’ve never thanked. First and foremost are George Brooks and David Newton, two managers who took chances hiring a young, relatively inexperienced guy who dropped out of law school because he wanted to plunge into the wonderful world of software development. If not for your faith in me, the chances you took, and the responsibilities that you gave me nearly 20 years ago, this book would certainly not exist. By far the two people who shaped the way that I’ve approached my secu- rity career more than anyone else are Greg Schaffer and Whitney Bell. I have no idea how you both put up with me, but you did. I think of your patience, guidance, trust, and mentorship often. And I hope that, in some little way each day, I’m able to reflect your values back into the world. Acknowledgments xi During my time at Gartner, I had the privilege to make great friends, have wonderful managers, and work with some of the brightest folks on the planet. To Ray Wagner, Andrew Walls, Ash Ahuja, Michele Caminos, Joanna Huisman, Tom Scholtz, Jeffrey Wheatman, Paul Proctor, Neil Wynne, Neil MacDonald, Ant Allan, Gregg Kreizman, Earl Perkins, Terry Hicks, and countless more, thank you for your friendship, guidance, and mentorship. For those who helped lead awareness efforts with me at my previous employers. Thank you! Roy Eggensperger for being my partner in crime way back in the 2006-ish timeframe and wanting to help move our awareness program forward in new, interesting, and crazy ways. And to Amber Styles- Emberson, Vladimir Skoric, and Kym Patterson, thank you for your tireless efforts in creating and running an innovative large-scale program under enor- mous internal pressure and external scrutiny. I have so many great coworkers at KnowBe4 that I work with every day and who encouraged me to tackle this project. First and foremost, I need to thank Roger Grimes. Thank you for believing that I can not only have a book proposal accepted, but also believing that I can deliver on my mission for the book. To Stu Sjouwerman for giving me the go-ahead to effectively split my attention for six months and for reading and providing encouraging feedback on my earliest drafts. You are an amazing CEO, leader, mentor, and friend. Thanks to Kevin Mitnick for your friendship and encouragement. I learn something interesting and fun (and often, scary) every time we get together. And, thank you to Kathy Wattman, Kendra Irimie, Mary Owen, Laurie Haynes, Roger Grimes, Erich Kron, Amanda Tarantino, Rob Henley, Greg Kras, and Alin Irimie. I could not ask for a better or more supportive group of folks to work with daily. Each of you are amazing and inspiring in so many ways. Thanks to Jim Shields, Rob McCollum, Richard Leverton and all the amaz- ing people at Twist & Shout for being the creative force and production exper- tise behind The Inside Man. This video series was a dream realized for me and was probably the most fun project I’ve worked on in my career. Believe it or not, even though I work for a vendor serving the security aware- ness market, I’ve received a ton of encouragement and support from other vendors in this space as I let them know about this book. Special thanks to Lance Spitzner (SANS Security Awareness), Lisa Plaggemier (InfoSec Institute), Tom Pendergast (MediaPro), and Masha Sedova (Elevate Security). Your faith in my handling of the material and encouragement throughout this project mean more to me than you can possibly know.